Hi all, I’m wondering if any of you have built and had monetization success with a free to play mobile game with premium features that simply doesn’t have a server backend.
I realize the level of abuse and hacking goes through the roof, but at the moment for my relatively simple game, part of me just wants to say screw being safe and dealing with a server. The other obvious downside is that if the user deletes the app there is no data integrity, and thus their progress will vanish (not ideal at all).
What’s your thoughts on this (or server validation in general?)
Not entirely sure about android marketplaces, but with Apple, other than consumables, purchases need to be restorable. So not having a backend isn’t really an option.
I’d say it wouldn’t be very hard to handle this kind of stuff.
If you make a database really really secure (that you KNOW) is secure, you could just do a simple integer. 0 = no, 1 = yes. If 1 is returned then they own whatever it is they bought.
This is in theory at least, so I can’t say. I’m fixing to start dealing with IAP’s an such with my Android game.
Just got my registration system and stuff done.
No. Never trust anything on or from the client. Ever. There is no such thing as a “really secure” client-side database, or for that matter, client-side data, stored or in-memory. Assume all data used by or sent from the client is exposed and can be altered in ways you don’t expect or want.
There are a LOT of threads discussing this. The bottom line is that once your program has used your Super Sekret H4x04 Codez to decrypt your “known secure” database, that data is somewhere in the program unencrypted and it’s trivial to get in there and change it. There are some products that go so far as to encrypt entire assemblies and decrypt just small parts at one time to limit exposure. I can’t imagine they’re good for game performance (if they’d even work with Mono, which seems unlikely), but even at that extreme, they still have to eventually expose things in “clear”.
At the end of the day, you don’t own the client device, so you don’t trust the client device. Plan accordingly.
I think you are missing my point, the client doesn’t say 0 or 1, the server does. If player purchases lets say 100 gold.
Run that code via the server, then the server then updates the 0 or 1.
Every time the player tries to use a hacked item, it then relays back from the server they have =“0”. If it’s Zero on the server it will force Zero on their end.
That’s how plenty of games have been doing it for years and years.
Try hacking Battlefield4 and get unlimited health. It won’t work.
All you’re doing is hacking a local display variable while when you get shot with 9999999 health your health will suddenly drop down to 50 because it got the actual real server value of your health rather than a hacked display value.
I mean I know it’s impossible to entirely prevent hacking, it will happen, it’s just a matter of time.
But protecting your databases is what I meant, it’s paramount to protect your databases from Injection.
last thing you want is 1 million accounts just get wiped because someone does a ’ or ‘1’=1’
Well at the end he said “What’s your thoughts on this (or server validation in general?)”
I gave my opinion on server validation, unless he’s meaning something else.
Without a server, there’s nothing else to discuss other than it’s a 100% chance from anyone it can be hacked.
And unless you save a file somewhere else on the players phone/device that data will be lost if they delete the game. But is it good to save a file in some random place on somebodies phone? After the Facebook Chat app people started freaking out about privacy stuff, so doubt many unless the game is really popular will want that.
But then again, that can be hacked/changed to say hey I bought this. So that’s not really helping any either.
It’s pretty much impossible without a Server backend of some sort. So as mentioned, there’s really nothing else to discuss on this topic because it’s not possible unless you want it hacked. (which you may or may not care).
I ran in to a pretty talented cheater in BF4 this summer TBH. The climbed in a Frogfoot jet and flew around gunning down people outside with his nose cannon. Whats funny is he could shoot through “solid” materials regardless. So you could within the Hotel on that one map taking place in a tropical area, with lots of sand bars and stuff + the skyscraper hotel flag “B” in the center. Well if you were in that place he could shoot at you through the walls while diving straight at it while in the jet. It was interesting to say the least.
If you’re not too worried about people hacking instead of buying, then it’s pretty easy on Android. You’ll get a lot of people downloading without paying, but you’ll also get some that are too lazy or unwilling to root their device to bypass the Play Store.
If you really want to prevent that, though, you need a server.
To be honestly I just skimmed through as well. I mean I read it, but when I saw that last part I went blank with everything else.